· Abstract ·
Smart homes bring convenience to daily life but also pose privacy and security risks. Smart sensors continuously collect information about the surrounding environment and transmit data remotely via wireless communication. To protect user privacy, a dual-modal fusion method for ZigBee device identification is proposed. First, ZigBee traffic data from smart home devices is passively captured through the air interface. Then, the device traffic is fragmented, extracting features such as timing and length of encrypted traffic in the text modality, and high-dimensional features of traffic images in the image modality. Finally, the text features of the encrypted traffic and the image features are fused to construct a device type identification model based on dual-modal fusion. Experimental results from 15 devices from 5 manufacturers show that even when the device’s wireless traffic is encrypted, this method achieves an accuracy of about 99% in ZigBee device identification, effectively recognizing smart sensors around users and protecting their privacy.
Citation format:
Li Rong, Lai Yicong, Li Leyan. A Dual-Modal Fusion Method for ZigBee Device Identification [J]. Cybersecurity and Data Governance, 2025, 44(2): 17-25.· Introduction ·
According to a 2024 smart home research report released by EEO, the market size of smart homes in China reached 755.81 billion yuan in 2023, and it is expected to reach 1,017.02 billion yuan by 2025. The integration of technologies such as the Internet of Things, cloud computing, and artificial intelligence is driving the prosperous development of the smart home industry. To achieve smart home automation, many smart devices are equipped with embedded sensors that continuously collect environmental data and execute corresponding strategies based on user settings, enabling intelligent interaction between devices. At the same time, smart home devices can communicate with cloud servers via wireless networks, allowing users to remotely view device status information through apps. Common short-range wireless communication protocols include Wi-Fi, BLE, and ZigBee. The ZigBee protocol, as a low-cost and low-power wireless communication protocol, is widely used in small smart sensors.
The widespread use of smart sensor devices, while convenient for people’s lives, also brings information security risks. Smart sensor devices continuously collect, transmit, and process user behavior information from the environment. If an intruder deploys small sensors nearby, they can remotely collect users’ personal privacy data. For example, an intruder can deploy door magnetic sensors around the user to analyze their travel patterns based on changes in the sensor’s status, or deploy human body sensors nearby to infer whether someone is at home based on the status of the body sensor, severely infringing on the user’s personal privacy and security.
To protect user privacy, it is possible to identify the smart sensors present by analyzing the wireless traffic of devices, eliminating potential security threats. Existing research mostly relies on obtaining device traffic from home wireless routers, capturing IP traffic between devices or between devices and cloud services to identify device information within smart homes. This scenario has certain limitations for users, as they may not be able to access the wireless network deployed by the attacker. Additionally, smart gateways further process traffic data after receiving smart device traffic, and some important device data features may be lost in the traffic data collected by wireless routers. Furthermore, existing ZigBee device identification research relies on application layer and link layer features of device traffic, and due to similar operational logic among different manufacturers’ products, performance in multi-device classification scenarios is insufficient.
Therefore, this paper proposes a dual-modal fusion method for ZigBee device identification. First, a new privacy protection scenario for smart homes is designed, targeting ZigBee protocol smart sensors, and ZigBee traffic data from the surrounding environment is collected through wireless sniffing. Then, by analyzing the unique operational patterns of smart devices, traffic from individual devices is extracted from the complete ZigBee network traffic, and the traffic is segmented based on the temporal relationships of the data. Finally, multi-dimensional features of the traffic are extracted in both text and image modalities, and a ZigBee device identification model is constructed by fusing the dual modalities. Experiments show that even when ZigBee traffic is encrypted, the identification model can effectively distinguish between different smart home devices from multiple manufacturers, achieving an accuracy of about 99% in device identification.
· Author Information ·
Li Rong, Lai Yicong, Li Leyan
(China Electronic Product Reliability and Environmental Testing Research Institute, Guangzhou, Guangdong 510610)
Click here/download the complete content
This article is included in the February 2025 issue of Cybersecurity and Data Governance!
Click the magazine cover to enter the electronic journal section
👇⬇⬇⬇